> CVE-2024-53263

« BACK_TO_HOME
PUBLISHED
2025-01-14 20:15
MODIFIED
2025-01-23 18:15
EPSS (Prob. Exploit)
1.06%
Top 35.2%
DATA SOURCES:
NVD 🔗 2025-10-18 RED HAT 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-11-11 OSV 🔗 2026-11-08

> DESCRIPTION

Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the `git-credential(1)` command without checking for embedded line-ending control characters, and then sends any credentials it receives back from the Git credential helper to the remote host. By inserting URL-encoded control characters such as line feed (LF) or carriage return (CR) characters into the URL, an attacker may be able to retrieve a user's Git credentials. This problem exists in all previous versions and is patched in v3.6.1. All users should upgrade to v3.6.1. There are no workarounds known at this time.

> AFFECTED_PRODUCTS

Red Hat - Red Hat Enterprise Linux 8
Version: 3.4.1
Red Hat - Red Hat Enterprise Linux 9
Version: 3.4.1
Red Hat - Red Hat Enterprise Linux 9.4 Extended Update Support
Version: 3.4.1
Red Hat - Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
Version: 2.13.3
Red Hat - Red Hat Enterprise Linux 8.4 Telecommunications Update Service
Version: 2.13.3
Red Hat - Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
Version: 2.13.3
Red Hat - Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
Version: 2.13.3
Red Hat - Red Hat Enterprise Linux 8.6 Telecommunications Update Service
Version: 2.13.3
Red Hat - Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
Version: 2.13.3
Red Hat - Red Hat Enterprise Linux 9.2 Extended Update Support
Version: 3.2.0
Red Hat - Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
Version: 2.13.3
Red Hat - Red Hat Enterprise Linux 8.8 Extended Update Support
Version: 3.2.0

> RED HAT SECURITY ADVISORIES

Red Hat Security Advisory: git-lfs security update
An update for git-lfs is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (...
Red Hat Security Advisory: git-lfs security update
An update for git-lfs is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, and Red Hat Enterprise...
Red Hat Security Advisory: git-lfs security update
An update for git-lfs is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, and Red Hat Enterprise...
Red Hat Security Advisory: git-lfs security update
An update for git-lfs is now available for Red Hat Enterprise Linux 8.8 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vuln...
Red Hat Security Advisory: git-lfs security update
An update for git-lfs is now available for Red Hat Enterprise Linux 9.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vuln...
Red Hat Security Advisory: git-lfs security update
An update for git-lfs is now available for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A C...
Red Hat Security Advisory: git-lfs security update
An update for git-lfs is now available for Red Hat Enterprise Linux 9.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vuln...
Red Hat Security Advisory: git-lfs security update
An update for git-lfs is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (...

> RED HAT SEVERITY ASSESSMENT

THREAT SEVERITY
Important

> GITHUB SECURITY ADVISORY

GHSA-q6r2-x2cc-vrp7 HIGH

Git LFS permits exfiltration of credentials via crafted HTTP URLs

AFFECTED PACKAGES:
GO / github.com/git-lfs/git-lfs
>= 0.1.0, <= 3.0.0
GO / github.com/git-lfs/git-lfs/v3
>= 3.0.0, <= 3.6.0
Fixed in: 3.6.1

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Git LFS permits exfiltration of credentials via crafted HTTP URLs

AFFECTED PACKAGES:
Unknown / Unknown
60 versions affected
ALIASES:
BIT-git-lfs-2024-53263, GHSA-q6r2-x2cc-vrp7, GO-2025-3390

> HISTORIQUE DES MODIFICATIONS

Première apparition
14/01/2025 20:15
Source: NVD
📊 ENRICHISSEMENT 18/10/2025 14:58
CVEPROJECT
Champ modifié: CVE Project
Ancienne valeur:
Non
Nouvelle valeur:
Oui
📊 ENRICHISSEMENT 18/10/2025 12:26
REDHAT
Champ modifié: Sévérité Red Hat
Ancienne valeur:
N/A
Nouvelle valeur:
{ "threat_severity": "Important", "severity_scale": null }
📊 ENRICHISSEMENT 18/10/2025 12:26
REDHAT
Champ modifié: Red Hat
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 3 Dernière mise à jour: 1 year ago
« BACK_TO_HOME